THEORIES  OF  ACCIDENT  CAUSATION 


Prepared  by  Michael  D.  Harvey,  Ph.D. 
Under  contract  to  the  Research  Branch 


/dlberlG 

WORKERS'  HEALTH,  SAFETY 
AND  COMPENSATION 
Occupational  Health  and  Safety  Division 


Canada  "^*'^"afe 


THEORIES  OF  ACCIDENT  CAUSATION 


Prepared  by  Michael  D.  Harvey,  Ph.D. 
Under  contract  to  the  Research  Branch 


December,  1984 


/dlbcna 

WORKERS'  HEALTH,  SAFETY 
AND  COMPENSATION 
Occupational  Health  and  Safety  Division 


Digitized  by  the  Internet  Archive 
in  2015 


https://archive.org/details/theoriesofaccideOOharv 


FOREWORD 


The  mission  of  the  Alberta  Occupational  Health  and  Safety 
Division  is  "to  prevent  work-related  accidents  and  ill  health 
and  to  promote  occupational  health  and  safety  in  Alberta".  In 
fulfilling  this  mission,  division  staff  depend  upon  information 
obtained  from  accident  investigation  reports  and  claims 
submitted  to  the  Workers'  Compensation  Board. 

The  significance  of  accident  information  to  the  division 
has  led  to  increased  interest  in  developing  more  effective  ways 
to  collect,  interpret  and  use  accident  data.  Paralleling  this 
trend  has  been  a  growing  awareness  that  issues  related  to 
accident  data  cannot  be  separated  from  their  theoretical 
context.  Dr.  Herbert  Buchwald.  Managing  Director  of  the 
Occupational  Health  and  Safety  Division,  first  articulated  the 
need  for  a  study  which  would  formally  examine  the  causal 
assumptions  of  different  theories  and  models  of  the  accident 
process.  Dr.  Buchwald  appointed  a  project  team,  comprised  of 
Judith  Evans.  Lynn  Hewitt,  and  John  McDermott.  to  further 
develop  the  concept  for  the  study  and  to  commission  a 
consultant  (Michael  D.  Harvey)  to  prepare  the  present 
theoretical  review. 

In  his  report.  Dr.  Harvey  identifies  and  describes  the 
major  theories  of  accident  causation  which  have  historically 
guided  the  occupational  health  and  safety  field.  A  subsequent 
report  will  examine  the  implications  of  these  theories  for 
accident  investigation  strategies. 
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EXECUTIVE  SUMMARY 


Theories  of  accident  causation  have  displayed  an  historical 
progression,  from  simple,  single  factor  theories  to  complex, 
multiple  factor  systems  approaches.  This  progression  reflects 
both  the  increased  research  sophistication  of  safety 
professionals  and  academics  as  well  as  an  increased  borrowing 
of  ideas  from  other  disciplines  (e.g.,  medicine,  sociology, 
psychology,  management  science,  and  education). 

Because  most  of  the  theorizing  about  the  causes  of 
accidents  has  been  directly  motivated  by  an  applied  concern 
with  accident  prevention,  there  exists  a  fuzzy  conceptual 
boundary  between  "theories  of  accident  causation"  and  "accident 
investigation  systems".  Results  of  accident  investigations  and 
theory-guided  research  into  accidents  are  potentially 
complementary  in  that  accident  investigations  can  uncover 
regularities  surrounding  accident  occurrence  (e.g.,  type  of 
machine,  characteristics  of  the  accident  victim),  which  can 
then  be  investigated  by  controlled,  theory-guided  research. 
Theory-guided  research  can  potentially  reveal  important  new 
types  of  information  to  be  gathered  in  accident  investigations. 


To  date,  there  have  been  few  research  studies  based  on  any 
of  the  major  theories  of  accident  causation.  Therefore, 
evaluation  of  these  theories  can  be  made  in  terms  of  their 
conceptual  properties  only. 


Single  factor  theories.  Single  factor  theories,  which 
identify  one  (or  a  few)  aspects  of  the  accident  as  the  "cause" 
and  propose  one  (or  a  few)  remedies  as  the  solution,  provided 
the  earliest  explanations  of  accident  causation.     Examples  of 
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these  theories  include  the  accident  prone  worker ,  psychodynamic 
(worker  motivation) ,  social-environment  and  domino  theories. 


Multiple  factor  theories.  Multiple  factor  theories 
represented  an  advance  over  single  factor  theories  in  that  they 
formally  acknowledged  the  possibility  that  many  factors  could 
potentially  cause  an  accident  to  occur.  The  epidemiological 
approach  to  accidents  (the  most  important  example  of  the 
multiple-factor  theory),  describes  accidents  in  terms  of  host 
(e.g.,  age  and  sex  of  victim),  environment  (e.g.,  working 
conditions)  and  agent  (i.e.,  the  physical  "cause"),  with  a  view 
toward  identifying  factors  contributing  to  the  accidents  and 
the  population  at  risk.  While  the  epidemiological  approach  has 
been  useful  in  studying  diseases,  it  is  unclear  how 
successfully  the  host-environment-agent  analogy  can  be  applied 
to  accidents. 

The  epidemiological  approach  explicitly  recognizes  that 
accidents  may  result  from  the  interaction  of  three  types  of 
variables.  However,  the  theory  provides  little  guidance  to  the 
researcher  as  to  which  host,  agent,  and  environment  variables 
and  which  interactions  are  most  promising  to  study. 

The  systems  approach.  Systems  theories  of  accident 
causation  focus  on  the  interaction  or  match  between  the 
individual  (e.g.,  psychological  processes  such  as  perception, 
memory,  and  decision  making),  and  the  demands  that  the  work 
task  places  on  the  individual.  Other  variables  (e.g., 
personality,  age,  energy  transfer,  etc.)  are  of  interest  only 
by  virtue  of  their  relationships  with  these  psychological  or 
task  variables. 
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According  to  systems  theory.  accidents  result  from  a 
mismatch  between  the  performance  of  the  machine  or  environment, 
and  the  performance  of  the  worker/operator,  whether  or  not 
damage  or  injury  occurs.  Thus,  systems  theory  concerns  itself 
with  the  interaction,  feedback,  and  adjustment  between  man, 
machine  and  environment.  Examples  of  systems  theory 
applications  from  the  literature  include  the  Surry  model, 
Andersson  et  &l's  extension  of  the  Surry  model  and  Hale  and  Hale's 
expectancy,  skill  and  decision  model.  Other  applications  of 
the  general  systems  model  have  been  developed  by  Smillie  and 
Ayoub,  Corlett  and  Gilbank,   and  Saari. 

Summary  and  Conclusions 

Single  factor,  two  factor  and  epidemiological  theories  have 
generally  failed  to  explain  the  nature  of  the  interaction  among 
accident  causes  and  have  concentrated  on  variables  which  are 
correlated  with  accident  occurrence  but  cannot  themselves 
directly  cause  accidents.  The  more  recent  systems  theory 
approach  begins  with  an  analysis  of  how  man  and  machine  (or 
environment)  interact,  and  focuses  on  primary  human  factors 
such  as  perception,  memory,  judgment  and  motor  skills.  Factors 
identified  by  the  earlier  theories  are  considered  to  be 
secondary  because  of  their  indirect  causal  influence  through 
these  primary  variables  (e.g..  age  affects  response  time). 

Implications  for  investigation.  In  order  to  understand  the 
cause  of  an  accident,  systems  theory  points  to  the  need  to 
gather  information  on  the  normal  and  abnormal  states  of  the 
operating  system.  Such  base  rate  information  is  critical  for 
understanding  the  relationship  between  accident  occurrence  and 
other  variables  of  interest. 
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Implications  for  prevention.  Systems  theory  suggests  that 
accident  prevention  efforts  can  be  directed  at  either  the 
operating  system  or  the  operator.  It  suggests  that  accidents 
can  be  avoided  by  increasing  the  reliability  and  decreasing  the 
variability  of  machine  performance  and  designing  the  machine  so 
that  it  provides  clear  and  accurate  danger  cues  to  the 
operator.  The  theory  also  suggests  many  ways  to  improve  the 
operator's  safe  and  efficient  task  performance. 

Implications  for  basic  research.  It  is  proposed  that 
priority  areas  for  basic  research  include:  the  development  of 
methods  for  observing  and  recording  the  operating  system,  and 
for  determining  the  danger  cues;  determining  human  limits  with 
respect  to  perception,  recognition,  recall,  risk  judgments  and 
performance:  and  distinguishing  between  primary  and  secondary 
human  factors. 
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THEORIES  OF  ACCIDENT  CAUSATION 


Theories  of  accident  causation  range  in  scope  from  the  simple, 
single  factor  theory  to  the  increasingly  complex  multiple  factor  systems 
theory  approach.     This  increasing  range  in  scope  follows  an  historical 
trend:  early  writers  proposed  single  factors  as  causes  (for  example, 
either  person  faults,  machine  faults,  or  chance),  while  the  systems 
theory  approach,  which  is  a  recent  development,  includes  many  factors 
as  well  as  their  interactions.     This  progression  is  an  understandable 
outgrowth  of  many  forces,  including  increased  research  sophistication 
among  accident  researchers  and  safety  professionals,  increased  adoption 
of  theories  and  concepts  from  other  disciplines,  and  the  increasing 
sophistication  of  the  disciplines  being  borrowed  from. 

Borrowing  from  other  disciplines  is  a  salient  feature  of  accident 
theories  and  models;  concepts  have  been  borrowed  from  medicine,  sociology, 
psychology,  management  science,  education,  and  others.     This  borrowing 
is  due  largely  to  the  applied  nature  of  accident  research;  accidents 
have  not  been  considered  an  intrinsically  interesting  topic  of  research 
in  themselves,  that  is,  the  research  and  theorizing  has  not  been 
motivated  primarily  by  curiosity.     Rather,  the  impetus  for  theory  and 
research  in  this  area  is  the  human  and  monetary  costs  associated  with 
industrial  accidents.     The  accident  is  a  social  problem,  and  researchers 
from  a  variety  of  disciplines  have  gravitated  toward  it,  bringing  with 
them  their  own  perspectives  on  the  issue,  their  own  theories,  methods, 
and  preferred  solutions.     As  a  consequence  there  is  a  diversity  of 
opinion  regarding  the  issues,  the  methods,  and  the  important  concepts. 
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This  diversity  is  a  mixed  blessing.     On  the  positive  side,  it  allows 
for  a  broad  choice  of  concepts,  models,  and  theories  to  employ  in  the 
research.     But  so  far  the  negative  aspects  of  diversity  have  out -weighed 
the  potential  advantages,  with  the  result  that  there  is  no  agreed-upon 
common  language  for  theory  and  research,  and  as  a  consequence  there  is 
little  cross-referencing  in  the  literature;  each  person  tends  to  write 
to  his/her  own  discipline  rather  than  to  the  whole  enterprise.  However, 
this  criticism    may  be  unfair,  since  the  significant  advances  in  theory 
and  research  on  accidents  are  quite  recent,  and  to  expect  integrative 
work  or  even  some  coherence  within  the  literature  may  be  premature  at 
this  stage.     Regardless,  the  present  state  of  affairs  in  the  literature 
makes  the  task  of  reviewing  theories  of  accident  causation  a  complex 
and  difficult  one. 

The  applied  nature  of  the  area  posed  another  problem  for  a  review 
of  theories,  namely,  that  there  exists  a  very  fuzzy  boundary  between 
what  are  referred  to  as  theories  and  what  might  best  be  described  as 
investigation  systems.     As  an  applied  discipline,  accident  researchers 
are  called  upon  to  determine  the  cause  of  a  particular  accident ,  and 
the  literature  which  speaks  to  this  task  will  typically  list  many 
variables,  the  presence  or  absense  of  which  are  to  be  reported.  The 
accident  investigator  then,  by  some  means,  identifies  one  or  more  of 
the  variables  as  probable  causes  of  the  accident.     This  is  essentially 
a  post  hoc  analysis  of  an  accident;  the  investigator  cannot  observe 
the  accident  in  progress,  but  must  reconstruct  it  and  the  conditions 
surrounding  it  in  a  variety  of  ways.     Retrospective  accounts  by  the 
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persons  involved  can  provide  general  information  about  the  nature  of 
the  task,  the  state  of  the  machinery,  and  the  condition  of  the  operator 
at  the  time  of  the  event,  and  records  can  provide  some  information 
about  the  operating  history  of  the  machine  and  its  operator.     But  in 
most  cases  a  complete  description  of  the  accident  event  itself  cannot 
be  obtained  (the  persons  involved  cannot  reliably  report  on  the  events 
immediately  prior  to  the  injury  or  damage,  nor  can  they  report  well  on 
their  perceptual,  cognitive,  and  judgmental  processes).     The  investigator, 
then,  can  only  obtain  a  large  array  of  secondary  descriptors  of  the 
event.     With  a  sufficient  number  of  such  accident  reports  an  investigator 
might  be  in  a  position  to  identify  possible  correlates  of  accidents  of 
a  certain  type,  and  to  identify  problem  areas  in  need  of  closer  study, 
but  only  rarely  can  a  cause  be  identified  for  any  given  accident. 

A  theory,  in  contrast,  begins  with  some  a.  priori  assumptions  about 
the  nature  of  accidents  and  some  h3rpotheses  as  to  the  causes  of  an 
accident,  and  from  this  framework  generates  a  list  of  potentially 
important  variables,  the  true  values  of  which  need  empirical  test.  A 
theory,  then,  directs  accident  research  by  identifying  those  variables 
that  must  be  included  in  it ,  and  can  identify  the  appropriate  conditions 
or  groups  to  be  contrasted  in  order  to  test  the  theory  adequately  (for 
example,  a  theory  can  indicate  the  nature  of  the  control  group  to  be 
included  in  order  to  test  some  causal  hypothesis) . 

These  two  sub-areas  of  the  discipline  —  accident  theory  and 
accident  investigation  —  are  potentially  reciprocal;  each  could  benefit 
from  the  work  of  the  other,  and  each  occasionally  merges  with  the  other. 
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For  example,  accident  investigation  might  identify  a  certain  regularity 
of  occurrence  in  accidents  (e.g., a  particular  machine,  a  particular 
process,  etc.)-     Theory-driven  research  might  then  be  directed  toward 
this  class  of  accident  in  order  to  understand  the  relationship  between 
the  secondary  indicator  and  the  accident  rate.     This  theory-driven 
research  could  in  turn  identify  new  observations  to  be  included  in  an 
accident  investigation.    The  fuzzy  boundary  between  theory  and  systems 
for  investigation  produced  instances  during  the  review  process  of 
articles  that  purported  to  be  models  or  theories  of  accident  causation, 
but  which  turned  out  on  closer  inspection  to  be  accident  investigation 
systems. 

Research  related  to  industrial  accidents  has  been  guided  largely 
by  the  applied  concerns  rather  than  by  theoretical  issues,  and  therefore 
is  unsuited  for  the  task  of  evaluating  the  theories  of  accident  causation. 
There  is  very  little  theory-guided  research  in  this  literature  with 
which  to  evaluate  the  theories  that  have  been  proposed,  and  this  is 
especially  true  for  the  more  recent  theories.     Therefore,  the  evaluation 
of  theory  in  this  paper  will  in  most  cases  be  conceptual  rather  than 
empirical. 


-  5  - 


A.  Single  Factor  Theories 

Included  in  this  section  are  the  early  theories  that  typically 
identified  one  aspect  of  the  accident  as  the  cause,  and  proposed  a 
single  remedy  as  the  cure.     The  majority  of  these  theories  are  rarely 
used  explicitly  today,  but  they  have  not  been  disposed  of  easily,  and 
the  ideas  expressed  by  them  still  enjoy  considerable  public  support. 
In  addition,  the  multiple-factor  theories  which  gradually  replaced  the 
simple  theories  often  reserved  a  niche  for  the  old  single  factor  theory. 

1.  The  accident  prone  worker. 

In  the  original  statement  of  this  theory  (Greenwood  and  Woods, 
1919;  Newbold,  1926),  it  was  proposed  that  accidents  were  not  randomly 
distributed  among  persons,  but  rather,  that  certain  persons  were  more 
likely  than  others  to  have  accidents.     The  theory,  then,  identifies 
the  individual  in  some  way  as  the  cause.     These  researchers  presented 
considerable  data  which  showed  that  a  small  number  of  persons  suffered 
more  accidents  than  would  be  expected  by  chance.     It  was  suggested  at 
this  time  that  personality  characteristics  might  differentiate  this 
"greater  than  chance"  group  from  the  general  population,  but  Newbold, 
and  Greenwood  and  Woods  were  careful  to  point  out  the  obstacles  in  the 
way  of  such  a  conclusion;  for  example,  the  problem  of  equal  exposure 
to  risk. 

These  cautions,  however,  were  not  heeded  by  later  researchers 
(eg..  Farmer  and  Chambers,   1939)  who  treated  the  accident-prone 
personality  type  as  a  fact,  and  the  search  was  on  for  a  measure  or  set 
of  measures  that  would  predict  which  individuals  would  have  multiple 


-  6  - 


accidents.     The  important  assumption  for  this  theory  was  that  accident- 
proneness  was  a  stable,  innate  characteristic  of  some  individuals;  in 
other  words,  an  accident-prone  person  would  have  a  higher  accident  rate 
regardless  of  task,  life  circumstance,  experience,  and  so  on.     But  the 
research  never  supported  this  assumption.     Despite  the  initial  caveats, 
exposure  to  risk  was  seldom  controlled  in  the  research.     Also,  the 
accident-prone  group,  as  identified  by  a  higher  than  expected  accident 
rate  during  one  time  period,  changed  its  composition  during  the  next 
time  period;  that  is,  there  was  considerable  temporal  instability  in 
the  accident  rates  of  individuals  (see  research  cited  in  Arbous  and 
Kerrick,  1951).     This  instability  of  accident  rate  (the  criterion 
measure  in  the  search  for  the  accident  prone  personality  type)  severely 
limits  the  ability  of  any  personality  variable  to  predict  an  individual's 
membership  in  an  accident  prone  group. 

Extensive  criticism  of  the  concept  in  the  early  1950' s  should  have 
eliminated  accident  proneness  as  a  theoretical  account  of  accidents 
(Arbous  and  Kerrick,  1951),  but  in  1969  J.  Surry  perceived  the  need  to 
reiterate  those  criticisms.     The  idea  that  some  people,  by  their 
personal  nature,  are  involved  in  accidents  is  an  appealing  one,  because 
it  implies  that  a  simple  solution  to  accident  rates  is  to  identify  the 
criteria  that  would  enable  one  to  screen  out  persons  who  are  identified 
as  accident  prone.     The  theory  has  lost  much  of  its  force  because  it 
has  failed  to  deliver  this  simple  solution.     But  this  is  not  to  deny 
the  value  of  identifying  those  persons  who  suffer  multiple  accidents. 
Shaw  and  Sichel  (1971)  argue  that  accident  proneness  be  retained  as  an 
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indicator  of  a  mis-match  between  the  worker  and  the  task,  However, 
this  use  of  the  concept  is  very  different  from  the  original  use,  since 
Shaw  and  Sichel  use  accident-prone  only  to  mean  multiple  accidents, 
without  any  implication  that  personality  factors  are  involved. 
2.  Psychod3mamic  theory. 

Unlike  the  above  approach,   this  theory  and  approaches  like  it 
implicate  the  motivations  of  the  injured  worker  as  the  cause  of  the 
accident.     The  psychodynamic  approach,  based  upon  Freud's  theory  of 
personality  dynamics,  is  the  clearest  statement  of  the  theory  of  a 
motivated  accident.     The  hypothesis  is  that  an  accident  is  the  result 
of  an  unconscious  wish  or  desire,  which  is  fulfilled  symbolically 
through  the  accident.     The  accident  is,  in  some  sense,  desired  by  the 
victim.     In  principle,  the  solution  to  accidents  becomes  a  simple 
matter  of  re-directing  the  means  of  wish-fulfillment  to  a  more  accept- 
able outlet,  or  eliminating  the  destructive  desire  entirely  by  means 
of  psychoanalysis.     However,  psychodynamic  theory  is  unworkable  as  a 
theory  of  accidents  since  it  provides  no  means  for  verifying  that  a 
particular  motive  caused  a  particular  accident.     It  remains,  I  think, 
only  a  curiosity  among  theories  of  accident  causation. 

I  bother  to  mention  the  psychodynamic  approach  at  all  because  it 
has  an  interesting  implication.     Unlike  the  accident  prone  individual, 
whose  character  faults  are  presumed  to  be  innate,  stable,  and 
unmodif iable,  unconscious  motives  are  subject  to  change.     In  other 
words,  the  theory  acknowledges  that  persons  who  suffer  more  than  their 
share  of  accidents  can  be  changed  into  accident-free  workers.  The 
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general  implication  is  that  one  could  take  members  of  the  "accident- 
prone"  group  and  reduce  its  accident  rate  through  some  form  of 
education  or  retraining,  rather  than  eliminate  the  group  from  the 
work  force  entirely. 

While  the  psychodynamic  approach  was  impractible  as  a  retraining 
method,  other  motivation-type  theories  could  be  proposed  that 
offered  more  practical  retraining  solutions.     For  example,  simple 
hypotheses  that  identified  carelessness  or  poor  attitude  as  the  cause 
of  accidents  share  a  kinship  with  the  psychodynamic  approach,  in  that 
they  identify  worker  motivation,  broadly  speaking,  as  the  cause,  and 
implicate  training  or  education  as  the  remedy.     That  carelessness  and 
poor  attitude  are  the  causes  of  industrial  accidents  are  accepted  as 
truisms  within  the  literature,  and  it  is  impossible  to  argue  that  these 
factors  are  not  implicated  in  at  least  some  accidents.     However,  it  is 
clear  that  these  factors  do  not  tell  the  whole  story;  accidents  often 
enough  happen  to  persons  whom  co-workers  and  supervisors  can  describe 
as  careful  and  dedicated.     In  other  words,  the  correlation  between  the 
predictor  and  the  criterion  are  apt  to  be  too  low  to  account  for  much 
of  the  variability  in  accident  occurrence. 

3.  Kerr's  social-environment  models. 

Kerr  (1957)  introduced  two  variables  relating  to  the  personal  and 
the  work  environment  which  he  felt  complemented  accident-proneness  as 
causes  of  accidents.     Kerr  claimed  that  these  new  factors  would  account 
for  all  accidents  that  could  not  be  accounted  for  by  the  proneness 
concept.     These  new  variables  described  the  freedom  allowed  within  the 
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workplace,  and  the  life-stress  experienced  by  the  worker,  as  factors 
that  would  decrease  and  increase,  respectively,  the  individual's 
accident  rate. 

The  goals-freedom- alertness  theory  held  that  the  freedom  to  set 
one's  own  reasonably  attainable  goals  is  accompanied  by  high  quality 
worker  performance.     The  idea  is  that  a  worker  who  is  able  to  make 
work-related  choices,  judgments,  decisions,  and  so  on  (that  is,  he/she 
has  work  freedom)  will  be  more  alert  on  the  job,  and  alertness  avoids 
accidents.     The  lack  of  work  freedom  produces  low  quality  performance, 
and  low  quality  performance,  according  to  Kerr,  produces  accidents. 
The  basic  argument,  then,  seems  to  be  that  a  rewarding  work  environment 
promotes  safety.     The  vagueness  of  the  definitions  and  the  range  of 
items  that  could  be  considered  rewards  in  the  workplace  (Kerr  suggests, 
for  example,  the  freedom  to  decorate  one's  work  station)  make  this 
theory  difficult  to  test.     At  best,  this  is  a  theory  of  how  to  promote 
safety  rather  than  a  theory  of  accident  causation. 

The  adjustment-stress  theory  held  that  unusual  or  distracting 
stress  on  the  individual  increases  liability  to  accidents  and/or  other 
low  quality  work  performance.     These  stresses  are  seen  as  temporary 
conditions  that  decrease  worker  alertness,  and  could  include  a  change 
in  job,  a  new  supervisor,  a  marriage,  death,  birth,  divorce,  disease, 
and  so  on.     Kerr  also  lists  purely  environmental  sources  of  possible 
stress  —  noise,  poor  lighting,  extremes  of  temperature  —  as  well  as 
ambiguous  sources  (eg. ,  time  constraints) ,  and  views  the  failure  to 
any  of  these  as  a  potential  cause  of  an  accident. 
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These  two  theories,  as  presented  by  Kerr,  merely  list  a  host  of  factors, 
without  stating  either  how  or  when  each  might  be  relevant  (he  does  not 
consider,  for  example,  that  people  will  differ  in  the  manner  they  choose 
to  express  their  workplace  freedom,  or  that  people  will  differ  in  the 
manner  and  efficiency  with  which  they  cope  with  his  list  of  stressors). 
Only  intuition  supports  Kerr*s  claim  that  these  factors  affect  alertness 
(this  concept  is  never  defined),  and  the  subsequent  probability  of  an 
accident.     While  Kerr's  approach  to  accident  causation  did  serve  to 
highlight  the  possible  contributions  of  "quality  of  life"  variables, 
his  theories  are  poor  guides  at  best  for  an  improved  understanding  of 
accident  causes. 

4.  Heinrich*s  Domino  Model,  and  variations. 

The  domino  model  describes  a  causal  chain  ending  in  an  injury. 
The  chain  begins  with  (1)  social  and  environmental  factors,  that  cause 
(2)  personal  faults  (carelessness,  ignorance),  that  cause  (3)  an  unsafe 
act  or  a  physical/mechanical  hazard,  that  causes  (4)  the  accident 
event,  that  results  in  (5)  injury  to  the  person.     This  chain  is  likened 
to  a  row  of  standing  dominos,  in  which  the  collapse  of  one  is  determined 
only  by  the  collapse  of  the  previous  one. 

This  model  makes  the  strong  claims  that  (a)  an  injury  is  always 
the  result  of  an  accident  (this,  I  believe,  defines  "accident"  for  the 
domino  mddel) ,  (b)  that  an  accident  is  always  the  result  of  an  unsafe 
act  or  a  mechanical  hazard,   (c)  that  these  are  always  the  result  of 
person  faults,  and  so  on.     Conversely,  the  model  claims  that  if  one 
performs  an  unsafe  act,  there  will  be  an  accident,  and  if  there  is  an 
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accident,  there  will  be  an  injury.     These  strong  statements  are  clearly 
false;  the  relationship  between  these  chained  causes  are  probabilistic, 
and  are  not  determined  in  an  absolute  sense.     Only  some  accidents  cause 
injury,  and  only  some  unsafe  acts  cause  accidents,  etc.     The  domino 
model  is  far  too  simple  for  a  complete  understanding  of  accidents. 

Several  variations  and  adaptations  of  this  model  have  been  proposed, 
primarily  for  use  by  management  safety  personel.     The  appeal  of  the 
model  for  safety  programmes  is  its  assumption  that  removing  one  domino 
only  will  eliminate  accidents  (by  breaking  the  chain) .     These  models , 
and  the  safety  programmes  developed  from  them,  have  focussed  upon  the 
middle  domino  —  unsafe  acts  and  mechanical  hazards  —  as  the  one  to  be 
eliminated.    While  this  may  be  a  practical  choice,  there  is  clearly  no 
theoretical  reason  for  it,  since  the  theory  gives  equal  causative  power 
to  each  domino.     The  revised  models  (see  Heinrich,  Petersen,  and  Roos, 
1980),  regardless  of  the  simplicity  or  complexity  of  the  diagrams  used 
to  describe  them,  are  invariably  lists  of  factors  that  may  contribute 
to  an  unsafe  act  or  hazard,  and  all  fail  to  specify  the  relationships 
among  the  members  of  the  list  beyond  the  level  of  category  membership. 
The  primary  use  of  these  models,  I  believe,  is  in  the  accident  invest- 
igation process,  and  for  the  organization  of  safety  management  systems; 
both  of  these  topics  are  beyond  the  scope  of  this  review. 
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B.    Multiple  Factors :  The  Epidemiological  Approach 

The  epidemiological  approach  to  accidents  (Gordon,  1949)  draws  an 
analogy  between  disease  and  accidents,  making  the  claim  that  the 
incidence  of  and  succeptibility  to  accidents  can  be  understood  in  the 
same  way  as,  for  example,  the  incidence  of  and  succeptibility  to  TB, 
polio,  or  syphilis.     This  approach  considers  the  features  of  the  host 
(that  is,  the  victim  of  the  disease/accident;  eg.,  age,  sex,  general 
health),  environment  (eg.,  living  quarters,  social  status,  time  of 
year,  etc.),  and  agent  (eg.,  the  physical  and/or  biological  nature  of 
the  virus,  bacteria,  poison,  etc.)  in  the  description  of  the  circum- 
stances of  the  disease,  with  a  view  toward  identifying  the  factors 
contributing  to  the  disease  and/or  identifying  the  population  at  risk. 
This  approach  has  had  considerable  success;  for  example,  in  demonstrating 
the  increased  risk  of  polio  during  the  warm  weather  months. 

In  the  medical  area,  the  usefulness  of  the  approach  is  due  in 
large  part  to  the  relative  easfe  with  which  the  agent  can  be  identified 
and  understood;  it  is  typically  a  biological  organism  whose  definition 
is  specific,  and  whose  characteristics  and  behavior  can  be  observed 
independently  from  host  and  environment.    The  difficulty  which  has 
plagued  the  adoption  of  the  epidemiological  approach  for  industrial 
accidents  is  the  problem  of  identifying  and  understanding  the  agent 
involved.     One  solution  has  been  to  characterize  the  agent  by  the  type 
of  damage  produced;  that  is,  to  classify  accidents  by  burns,  cuts,  falls, 
breaks,  strains,  and  so  on,  to  various  parts  of  the  body  (this  seems 
very  much  to  be  a  medical  solution).     A  second  solution  has  been  to 
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classify  the  type  of  energy-implement  combination  (the  source  of  injury) 
involved  in  the  accident;  for  example,  mechanical,  electrical,  or 
radiant  energy  emanating  from  some  machine  or  object. 

The  agency  debate  itself  has  been  a  source  of  difficulty  for  this 
approach  to  accidents,  and  it  highlights  what  may  be  a  major  flaw  in 
the  analogy  between  accident  and  disease.     To  hold  firm  to  the  analogy, 
characterizing  the  agent  as  an  energy  transfer  type  rather  than  a 
damage  type  seems  to  be  most  appropriate,  since  both  energy  and  virus 
(for  example)  are  immediate  causes  of  the  illness/accident  sjmiptoms. 
However,  the  disease  agent  is  never  benign,  but  only  more  or  less 
malevolent,  while  the  energy  source  more  often  than  not  is  benign;  that 
is,  it  serves  its  function  properly  most  of  the  time.     The  agent 
problem  in  the  epidemiological  approach  may  not  be  a  problem  in  principle, 
but  it  is  a  problem  in  practice,  as  it  introduces  a  third  list  of 
variables  for  accident  research  to  identify  and  define,  a  list  that 
may  not  exist  independently  from  host  and  environment  variables. 

The  use  of  a  disease  model  analogy  for  understanding  accidents 
has  a  further  shortcoming.     Typically,  the  epidemiologist  knows  what  _ 
the  disease  agent  is,  and  to  this  extent  knows  the  cause  of  the  disease." 
Epidemiology,  then,  was  neither  designed  nor  intended  to  identify 
cause;     rather,  its  purpose  was  to  identify  (1)  the  environment  that 
supported  the  cause,  and  (2)  the  characteristics  of  the  persons-hosts 
who  were  succeptible  to  the  disease.     An  epidemiological  study  does 
not  proceed  until  the  cause  (virus  or  bacteria,  for  example)  has  been 
identified;  it  cannot  proceed  because  the  researchers  cannot  know  which 

"See  Research  Branch  note,  page  ^7. 
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cases/incidents  to  investigate  without  this  information.     As  a  model 
for  accident  research,  epidemiology  will  be  appropriate  for  the  two 
purposes  mentioned  above,  but  only  when  the  agent-cause  of  the  accident 
is  understood  as  well  as  are  the  viral  and  bacterial  causes  of  disease. 
The  systems  approach,  described  in  the  next  section,  offers  one  way  to 
accomplish  this  level  of  understanding,  by  advocating  a  microscopic 
examination  of  man-machine  interactions. 

The  epidemiological  approach,  however,  was  a  theoretical  advance 
over  the  previous  models  of  accident  causation,  in  that  it  explicitly 
acknowledged  the  conditional  nature  of  the  relationships  among  causal 
factors.     In  other  words,  the  approach  recognized,  albeit  simply, 
that  accidents  were  an  interaction  of  some  sort  among  three  classes  of 
variables,  and  promoted  research  and  investigation  procedures  that 
observed  all  three  types.     This  research,  however,  would  have  to  be  of 
immense  proportions,  since  epidemiology  could  not  identify  which  host, 
agent,  and  environment  variables  might  be  most  promising.     To  attempt 
to  record  everything  would  be  overwhelming,  but  to  sample  only  a 
manageable  few  would  always  leave  unknown  questions  unanswered.  Without 
specific  guidance  from  the  theory  (and  the  theory  does  not  provide 
this)  there  is  no  way  to  evaluate  the  adequacy  of  the  research  choices 
that  are  made. 
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C^.     The  Systems  Approach 

The  theories  and  models  of  accident  causation  described  below  are 
similar  to  each  other  in  that  their  general  focus  in  on  the  details  of 
the  interaction  between  the  individual  and  the  task.    Unlike  previous 
approaches,  which  may  merely  mention  that  a  man-machine  interaction 
exists,  the  systems  approach  seeks  to  describe  the  psychological 
processes  involved  in  such  an  interaction,  and  to  identify  the  nature 
of  situations  in  which  an  accident  might  be  expected  to  occur.  Of 
central  importance  are  the  processes  concerned  with  perception,  memory 
and  knowledge,  and  decision  making.     Variables  which  were  previously 
considered  central  to  a  theory  of  accidents  (eg.,  personality  type,  age, 
sex,  culture,  energy  type,  etc.)  have  only  secondary  importance  within 
a  systems  approach,  and  have  this  importance  only  by  virtue  of  their 
relationships  (if  any  exist)  with  the  psychological  processes  of  interest. 
Thus,  for  example,  age  might  be  a  relevant  systems  variable,  but  only 
because  of  its  possible  correlation  with  the  amount  and  type  of 
information  in  memory. 

Systems  models  share  a  common  intellectual  heritage  from  electrical 
engineering,  variously  known  as  control  theory,  cybernetics,  or  robotics 
(Weiner,    1948).     The  central  concept  in  control  theory  is  the  negative 
feedback  loop,  which  enables  the  system  to  incorporate  a  self -correcting 
mechanism.     The  household  thermostat  is  a  familiar  example  of  a  negative 
feedback  loop;  this  system  takes  room  temperature  as  an  input,  compares 
this  input  with  the  desired  room  temperature  (the  standard) ,  and  if  the 
input  is  lower  than  the  standard  the  system  reduces  the  discrepancy  by 
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starting  the  furnace.    The  word  "negative"  refers  to  the  function  of 
system,  which  is  to  reduce  the  discrepancy  between  the  input  and  the 
standard.     The  concept  of  a  negative  feedback  loop  has  been  applied  to 
the  human  system  and  to  other  biological  systems  as  well;  for  example, 
in  matching  the  visual  input  to  standard  features  stored  in  memory  in 
the  process  of  recognizing  an  object,  or  in  making  correct  adjustments 
in  the  extent,  direction,  and  velocity  of  an  arm  movement  when  catching 
a  ball.     A  simple  diagram  of  a  negative  feedback  loop  is  shown  in 
Figure  1  (see  next  page). 

To  illustrate  the  various  features  of  the  feedback  loop  with  a 
human  performance  example,  consider  the  task  faced  by  a  baseball  catcher. 
The  task  is  to  match  the  position  of  the  glove  with  the  final  position 
of  the  ball.     The  position  of  the  glove  is  compared  to  the  position  of 
the  ball,  and  any  difference  is  noted  by  the  comparator.     Action  is 
then  taken  on  the  glove  to  change  its  position  (behaviour  output  affects 
the  environment).     Such  comparisons  and  adjustments  in  glove  position 
are  repeated  until  the  positions  match.     The  interesting  question  for 
this  example  is  the  nature  of  the  standard.     For  the  novice,  the  standard 
may  be  ball  position,  but  with  practice  at  catching  a  ball  the  standard 
can  become  an  estimate  of  the  endpoint  of  the  ball's  path,  given  an 
estimated  speed  and  angle  of  flight.     The  glove  is  then  moved  initially 
to  this  expected  endpoint,  and  finer  adjustments  can  be  made  if  any 
subsequent  estimate  predicts  a  different  endpoint. 

The  professional  baseball  catcher  (an  expert)  has  at  his  disposal 
a  set  of  standards  that  can  be  used;  for  example,  he  can  signal  for  a 
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low  inside  curve  ball  from  the  pitcher.     This  becomes  the  standard  for 
the  glove  position  because  the  catcher  has  reason  to  expect  the  ball  to 
arrive  at  that  position.     This  expectation  is  founded  upon  the 
reliability  of  his  machine  (that  is,  the  pitcher)  to  deliver  as 
instructed.    A  catcher  could  have  a  high  expectation  about  one  type  of 
pitch  (eg.,  a  fastball)  but  a  low  expectation  about  another  (eg.,  a 
knuckleball) .     With  a  higher  expectation  comes  a  lower  necessity  to 
make  adjustments,  whereas  constant  adjustments  and  constant  vigilance 
are  required  in  order  to  catch  the  knuckleball. 

The  possibility  for  error  in  such  a  system  abounds.  The  input  may 
not  accurately  represent  the  environment  (a  perception  error) ,  the 
standard  may  not  be  appropriate  to  the  task  (a  knowledge  error) ,  the 
output  may  not  meet  the  requirements  of  the  task  (a  skill  deficiency)  , 
and  any  perturbations  in  the  environment  (a  gust  of  wind,  or  a  foul 
tip,  in  the  baseball  example)  may  require  a  new  standard  to  be  chosen. 
Any  of  these  possibilities  may  result  in  a  dropped  ball  —  an  error  or 
an  accident.    From  the  systems  theory  perspective,  an  accident  occurs 
whenever  there  is  a  mis-match  between  the  performance  of  the  machine 
(the  operating  system),  and  the  performance  of  the  operator,  whether 
or  not  damage  or  injury  occurs. 

The  models  described  on  the  following  pages  all  view  industrial 
accidents  from  a  general  systems  theory  perspective.     Systems  theory 
focus ses  upon  the  interaction,  feedback,  and  adjustment  between  man, 
machine,  and  environment,  and  is  capable  of  indicating  the  temporal 
order  of  the  events  that  contribute  to  the  accident  event. 
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1.  Jean  Surry  (1969):     Human  engineering  approach 

The  Surry  model  consists  of  two  phases  for  an  accident,  with  each 
phase  containing  three  psychological  components;   the  perception  of 
events,  the  understanding  of  events  (cognitive  activity),  and  the 
behavioral  response.     Phase  one  is  concerned  with  the  build-up  of  the 
danger,  and  the  perceptual,  cognitive,  and  behavioral  responses  relevant 
to  this  danger.     Phase  two  is  concerned  with  the  operation  of  these 
same  three  components  during  what  Surry  calls  the  danger  release  period, 
that  period  during  which  the  danger,  if  not  avoided,  will  produce  damage 
or  injury.     A  schematic  diagram  of  this  model  appears  in  Figure  2. 

Each  component  of  each  phase  is  described  by  one  or  more  questions. 
Questions  relevant  to  the  build-up  phase  begin  by  asking    "Is  there 
any  objective  warning  cue  for  a  build-up  of  danger?"    This  question 
asks  only  about  the  immediate  state  of  the  environment,  and  can  be 
rephrased  by  asking  whether  or  not  a  perceptible  difference  exists  in 
the  environment  between  a  safe  operating  state  and  a  hazardous  one 
(that  is,  a  state  in  which  damage  or  injury  is  probable  if  evasive 
actions  are  not  taken).     Close  observation  of  the  environment  during 
normal  operation  would  be  required  in  order  to  determine  the  existence 
and  nature  of  the  danger  cues  (experience  on  the  job  could  in  theory 
provide  this  information,  but  it  may  well  fall  short  in  practice).  A 
second  implication  of  this  feature  of  Surry's  model  is  the  implicit 
acknowledgment  that  danger  may  have  no  perceptible  cue  associated  with 
it;  thus,  some  accidents  may  be  unavoidable,  since  they  occur  without 
warning.     The  first  question  of  phase  two  of  the  Surry  model,  which 
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FIGURE  2 


Man  and  Environment 


No  Hazard  j  Hazard  -  -  Imminent  Danger 


Figure  2.  The  Surry  (1969)  model  of  accident  causation. 
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asks  about  the  presence  of  a  cue  that  signals  danger  release,  is 
subject  to  these  same  comments. 

The  second  question  in  each  phase  asks    "If  there  is  a  cue,  can 
it  be  detected  by  the  operator?"    This  question  asks  about  the 
perceptual  capabilities  of  the  operator  with  respect  to  the  danger  cue. 
The  most  basic  human  f actors/senses  are  involved  here;  for  example, 
visual  acuity,  auditory  signal  detection,  kinesthetics,  and  so  on. 
Also  relevant  to  this  question  are  the  effects  of  'noise' ,  tasks  that 
demand  a  great  amount  of  attention,  etc.     Quite  apart  from  a  lack  of 
vigilance  on  the  part  of  the  operator,  a  danger  cue  may  not  be  perceived 
because  the  human  sensory  system,  in  that  operating  environment,  is 
unable  to  detect  it.     Thus,  if  a  danger  cue  is  known  to  exist,  yet 
noise  or  attentional  overload  prevent  its  detection,  instruments  that 
would  change  or  amplify  its  signal  should  be  installed  to  make  the 
detection  of  the  cue  possible  for  the  operator. 

Surry  proposes  three  questions  relevant  to  the  cognitive  component 
of  each  phase,  questions  that  ask  about  (a)  the  meaning  of  the  danger 
cue,   (b)  the  operator's  knowledge  of  avoidance  responses,  and  (c)  the 
decision  to  avoid  or  not.     To  understand  the  meaning  of  the  danger  cue 
is  to  know  or  recognize  that  the  cue,  the  particular  change  in  the 
environment,  does  in  fact  signal  danger.     A  squeek,  a  movement,  or  the 
absense  of  a  familiar  object  may  be  either  a  knoxm  or  an  unknown  danger 
cue  for  the  operator.     Recognition,  then,  requires  that  the  operator 
knows  what  the  danger  cues  are  for  a  particular  operation,  and  knows 
what  danger  is  implied  by  each  cue.     The  second  question  in  this  set 
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points  out  that  a  knowledge  of  avoidance  behaviors  is  also  necessary. 
These  behaviors  may  be  simple  (eg.,  switch  off  the  machine),  or  they 
may  be  elaborate  (eg.,  shoring  up  an  unstable  trench),  but  probably 
all  responses  to  danger  cues  can  benefit  from  training.    However,  the 
Surry  model  makes  it  very  clear  that  such  training  in  avoidance  skills 
is  irrelevant  if  the  danger  cues  for  the  operation  are  either  unknown 
or  unrecognized;  knowing  what  could  happen  is  a  pre-condition  for 
knowing  how  to  react  to  possible  danger. 

The  next  step,  the  decision  to  avoid,  is  a  most  interesting 
feature  of  the  model.     It  states  simply  that  the  operator  may  choose, 
on  the  basis  of  perceived  risk,  to  ignore  potential  danger.     By  the 
inclusion  of  a  step  such  as  this  in  an  accident  model,  Surry  implies  a 
probabilistic  relationship,  and  not  a  perfect  one,  between  the  danger 
cue  and  the  subsequent  danger  release  (although  this  feature  of  the 
model  is  not  made  explicit).     A  decision  to  ignore  a  danger  signal 
would  make  sense  at  this  point  only  if  the  operator  knows  that  the  cue 
sometimes  does  not  signal  an  impending  accident,  injury,  or  damage. 
The  operator  at  this  step  judges  the  risk,  or  probability,  that  the 
danger  release  will  occur,  and  may  include  as  a  factor  in  this  decision 
the  various  costs  and  benefits  associated  with  the  avoidance  behavior 
(for  example,  shut-down  time,  loss  of  production,  safety).  Also 
relevant  to  this  decision  may  be  a  consideration  of  the  operator's  own 
self-perceived  ability  to  avoid  danger  release  (the  final  step  in  phase 
two)  should  that  become  necessary.     The  speculation  here  is  that  an 
experienced,  competent  operator  may  take  greater  risks  during  the  first 
phase,  believing  that  he/she  is  skillful  enough  to  avoid  the  subsequent 
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release  of  danger. 

One  can  conceive  of  objective  risk  as  the  actual  probability  that 
danger  release  is  predicted  by  the  danger  cue,  and  subjective  risk  as 
the  operator *s  estimate  of  this  probability.     Under-estimation ,  then, 
will  result  in  more  instances  of  danger  release  than  is  warranted  by 
the  operation,  while  over-estimation  may  result  in  a  slower  rate  of 
production  due  to  unnecessary  evasive  actions  by  the  operator.  The 
variables  that  affect  the  estimation  of  risk  and  the  acceptibility  of 
risk,  as  well  as  the  estimation  of  probability  in  general,  have  been 
researched  to  some  extent  in  the  psychological  literature  (eg.  ,  Slovic, 
Fischoff,  &  Lichtenstein,  1976;  Kahneman  and  Tversky,   1984).  Kahneman 
and  Tversky,  for  example,  have  shown  that  risks  are  sought  or  avoided 
depending  upon  how  the  individual  thinks  of  the  consequences  of  the 
choice;  if  the  probable  outcome  is  described  as  a  loss,  people  prefer 
risk,  but  if  the  outcome  is  described  as  a  gain  people  avoid  risk. 
However,  a  theory  of  decision  and  risk  that  would  contribute  directly 
to  the  understanding  of  risk-taking  in  an  industrial  setting  has  yet 
to  be  developed  (although  the  potential  is  there  for  a  useful  extension 
of  these  concepts  into  accident  research). 

The  behavioral  component  is  the  concern  of  the  final  question  of 
each  phase;     "Is/can  the  action  taken  succeed  in  avoiding  the  danger?" 
Motor  skills  are  clearly  implicated  here  (eg. ,  quickness,  agility, 
accuracy),  but  the  more  subtl e  implication  of  the  Surry  model  is  that 
on  occasion  even  the  correct  behavioral  response  may  fail  to  avoid  the 
danger.     The  notion  of  random  variability  or  random  error  (in  the 
statistical  sense)  is  a  basic  part  of  the  model;  it  asserts  that  all 
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occasions  of  the  same  behavior  are  not  identical  in  all  respects,  but 
that  they  vary  somewhat  from  one  time  to  the  next  in  terms  of,  for 
example,  speed  or  accuracy.     A  danger  that  can  be  avoided  by  a  reaction 
time  of  one  second  or  less  can  be  avoided  most  of  the  time,  but  not 
all  the  time,  by  a  person  whose  reaction  time  averages  900msec. ;  the 
variability  of  response  speed  may  be  such  that  reaction  time  exceeds 
the  critical  time  of  one  second  5%  of  the  time.     The  resultant  injury 
or  damage  in  such  a  case  would  be  due  to  the  variability  or  error  that 
is  inherent  in  the  person* s  motor  response  system.     It  is  error  that 
cannot  be  controlled  by  the  individual. 

In  a  similar  manner,  one  can  conceive  of  the  variability  that  is 
associated  with  the  danger  release  mechanism.     For  some  particular 
hazard,  the  danger  cue  may  signal  that  danger  release  will  occur  in  two 
seconds,  on  average.     But  the  variability  in  danger  release  time  may 
mean  that  on  rare  occasions  only  one  and  one-half  seconds  are  available 
to  make  the  necessary  avoidance  response,  and  this  amount  of  time  may 
be  less  than  the  time  required  to  avoid  the  danger  release.     This  sort 
of  variability  could  be  reduced  through  improved  machinery  or  improved 
maintenance,  or  through  improved  skill  on  avoidance  tasks,  in  some 
cases,  but  the  concept  of  the  inherent  variability  of  systems  suggests 
that  there  will  be  a  lower  limit,  and  that  beyond  this  point  no  further 
amount  of  time,  effort,  or  money  can  eliminate  this  variability  of  the 
system.     It  is  in  this  respect  that  one  can  truly  say  that  "accidents 
will  happen".     The  question  is  how  much  variability  can  be  tolerated 
within  the  system. 
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2.  Andersson  et  al.   (1978):  An  extension  of  the  Surry  model 

Andersson  et  al.    (1978)  made  use  of  the  Surry  model,  and  of  the 
questions  posed  in  it,  in  an  analysis  of  the  causes  of  sixty  industrial 
accidents,  and  concluded  that  a  sizable  deficiency  existed  in  the  list 
of  questions  included  in  the  model.     They  point  out,  correctly,  that 
the  Surry  model  deals  explicitly  with  the  operator,  but  not  with  the 
operating  process  (that  is,  with  the  machine  and  its  surround).  What 
Surry  includes  implicitly  in  her  model,  Andersson  et  al.  make  explicit 
by  the  addition  to  her  model  of  a  prior  set  of  questions/ steps  that 
concern  the  source  of  and  the  perceptibility  of  the  danger  cue,  the 
fluctuations  (variability)  within  the  operating  system,  and  the 
potential  for  controlling  and/or  reducing  these  fluctuations  to  the 
point  at  which  they  are  compatible  with  the  fluctuations  in  the  human 
operator's  behavior.     By  directing  attention  to  the  work  setting  at  the 
same  level  as  Surry  addresses  the  human/psychological  processes,  these 
authors  provide  a  useful  and  compatible  completion  for  the  model 
developed  by  Surry  (see  Figure  _3  for  a  diagram  of  their  addition  to  the 
Surry  model) . 

Several  aspects  of  the  new  set  of  questions  proposed  by  Andersson 
et  al.   (see  Figure  3^)  have  been  dealt  with  in  my  discussion  of  Surry, 
and  will  not  be  repeated  here.     Unfortunately,  Andersson  et  al.  are  at 
times  less  than  clear  about  the  meaning  of  some  of  their  questions, 
and  as  a  result  my  explication  of  the  steps  in  their  expanded  model 
may  not  accurately  describe  their  vision  of  the  model.     The  Andersson 
addition  begins  with  a  controllable  system  (an  uncontrollable  system. 
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for  example,  lishtning,  cannot  be  handled  by  this  initial  phase  of  the 
model),  and  first  asks  if  the  system  is  observable,  either  technically 
(that  is,  with  instruments)  or  perceptually  (that  is,  with  the  human 
senses).     The  question    "Is  perception  possible?"  asks  about  background 
noise,  lighting,  barriers,  and  so  on,  which  may  obstruct  perception  of 
the  work  process.     The  following,  related  question  asks  if  the  person 
is  more  or  less  prepared  to  observe  the  operating  system;  that  is, 
does  the  operator  know  how  the  system  works,  what  sort  of  noises  or 
movements,  etc.,  it  makes?    Related  considerations  at  this  point  of  the 
analysis  concern  the  degree    to  which  the  operation  promotes  fatigue, 
stress,  or  decreased  vigilance  that  may  interfere  with  accurate  system 
observation.     Note  that  these  questions  and  concerns  are  similar  to 
those  prompted  by  the  first  step  in  the  Surry  model,  except  that  for 
Andersson  et  al.  attention  is  directed  toward  the  whole  system  rather 
than  toward  a  particular  danger  cue  only. 

The  next  two  questions  ask  about  operator  performance  variability; 
how  much  is  there,  and  does  the  operating  system  provide  adequate  time 
and  space  to  accomodate  these  behavioral  fluctuations.     If  it  does, 
then  the  operating  system  can  be  considered  to  be  a  safe  one;  if  not, 
then  system  modifications  (of  either  machines  or  procedures)  must  be 
developed  that  will  safely  allow  for  the  expected  range  of  behavioral 
variation.     It  is  important  to  note,  however,  that  a  safe  system  need 
not  be  danger-free;  a  safe  system  is  one  in  which  the  danger  is  known, 
observable,  controllable,  and  minimized  and/or  avoidable  because  it  is 
designed  with  a  certain  degree  of  human  interaction  variability  in  mind. 
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The  remainder  of  the  Andersson  et  al.  model  deals  with  the  operator's 
avoidance  responses,  in  a  manner  similar    to  the  Surry  model. 

For  the  Surry  model,  and  its  extension  by  Andersson  et  al.,  the 
key  to  understanding  the  causes  of  industrial  accidents  rests  with 
two  types  of  knowledge:   (1)  knowing  in  detail  the  physical  operation, 
the  variability  of  tools,  materials,  machines,  and  procedures,  and 
(2)  knowing  the  perceptual  and  motor  capabilities  of  the  operator 
within  the  operation  setting.     In  short,  considerable  research  on  any 
system  is  required  in  order  to  understand  how  it  normally  works,  and 
how  it  can  go  wrong. 

3.  Hale  &  Hale  (1970):  Expectancy,  skill,  and  decision 

Hale  and  Hale  (1970)  consider  an  accident  to  have  occurred  when 
an  individual  fails  to  cope  with,  or  fails  to  respond  appropriately  to, 
the  true  state  of  affairs;  whether  an  injury  or  damage  result  or  not 
is  irrelevant  to  their  definition.     Like  Surry,  Hale  and  Hale  focus 
their  model  on  the  ongoing  operation,  on  the  interaction  between  the 
operator  and  the  operating  system.     They  make  this  focus  very  clear  by 
describing  the  model  as  a  closed  loop.     Essentially,  their  feedback 
loop  consists  of  the  following  elements;   (1)  the  situation  is  perceived, 
(2)  the  information  is  processed,   (3)  the  operator  acts  such  that  the 
situation  is  changed,   (4)  it  is  then  newly  perceived,  processed,  and 
responded  to,  and  so  on.     A  diagram  of  the  Hale  and  Hale  model  is  shown 
in  Figure  4_. 

Presented  information  consists  of  the  information  about  the  state 
of  the  operating  system  that  is  available  to  the  operator.  This 
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information  may  be  incorrect  (eg. ,  because  of  faulty  instruments)  or 
it  may  be  incomplete  (that  is,  some  information  about  the  system  may 
be  unavailable  to  the  operator;  it  may  be  imperceptible),  and  both  of 
these  possibilities  could  result  in  performance  errors.     In  this  respect 
the  Hale  and  Hale  model  differs  little  from  the  Surry  model,  except 
that  Surry  is  more  comprehensive  on  this  aspect  of  the  process. 

But  Hale  and  Hale  also  give  equivalent  status  to  the  role  of 
expected  information  as  a  contributor  to  what  is  perceived  by  the 
operator  about  the  operating  system.    They  note  that  expectancy  often 
guides  our  perception  and  selection  of  information.     An  expectancy  is 
more  than  the  knowledge  of  what  information  the  system  might  present; 
it  also  contains  the  probability  or  likelihood  that  a  particular  state 
of  affairs  will  exist.     An  expectancy  predominantly  consists  of  the 
usual  or  typical  state  of  affairs,  and  may  contain  little  information 
regarding  system  aberrations,  or  low  probability  events.     To  the  extent 
that  an  expectancy  guides  perception,  then,  two  types  of  error  can 
occur:   (1)  the  operator  may  "perceive"  that  a  typical  feature  is  present 
when  it  is  in  fact  absent,  and  (2)  the  operator  may  fail  to  perceive 
the  low  probability  features  that  are  on  occasion  present.     In  addition, 
an  expectancy  could  fill  in  the  gaps  that  exist  when  the  presented 
information  is  incomplete.     Hale  and  Hale  propose  that  over-reliance  on 
expectancy  information  at  the  expense  of  presented  information  would 
be  especially  likely  for  routine  and  repetitive  tasks  (tasks  with  low 
variability  from  one  time  to  the  next),  and  when  the  operator's  state 
is  such  that  attention  to  or  the  ability  to  perceive  the  presented 
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information  is  impaired  (for  example,  stress,  fatigue,  medication,  etc. 
may  make  vigilance  too  effortful  or  even  impossible). 

Behavioral  decisions  follow  from  the  perceived  information,  and 
training,  experience,  and  knowledge  of  the  operating  system  are 
important  factors  at  this  point.     Perceived  information  indicates  the 
state  of  the  operating  system;  if  the  system  appears  to  be  normal, 
normal  actions  are  taken.     Training  and  experience  typically  provide 
knowledge  about  the  normal  actions,  and  accidents  that  occur  under 
these  conditions  might  be  attributed  to  insufficient  knowledge  about 
appropriate  actions.     The  response  to  an  abnormal  state  of  the  system 
requires  different  knowledge  and/or  skills  that  may  or  may  not  have 
been  provided  by  training  or  past  experiences.     In  agreement  with  Surry, 
Hale  and  Hale  point  out  the  necessity  for  the  operator  to  know  about  the 
operating  system,  both  its  typical  state  and  its  possible  aberrant 
states,  and  to  know  the  actions  appropriate  to  each. 

Hale  and  Hale  include  a  decision  step  with  respect  to  the  action 
taken  by  the  operator.     In  addition  to  the  considerations  included  in 
the  Surry  model  (those  based  upon  the  risk  within  the  system) ,  Hale 
and  Hale  suggest  some  extra-system  factors  bearing  on  risk  and  decision. 
These  consist  of  group  norms  and  motivational  factors.     While  Hale  and 
Hale  do  not  elaborate  on  the  definition  of  these  factors,  I  believe 
that  they  wish  to  include  here  a  consideration  of  how  the  operator's 
acceptable  level  of  risk  tolerance  is  affected  by  (1)  the  level  of  risk 
acceptable  to  co-workers,  and  (2)  the  operator's  judged  value  of  lost 
time  versus  production  speed,  for  example,  as  a  motivation  for  changing 
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his  risk  tolerance  level. 

Finally,  according  to  the  Hale  and  Hale  model,  errors  may  occur 
due  to  variability  in  the  appropriate  response  to  the  system.    Hale  and 
Hale  make  explicit  here  what  Surry  only  implies,  and  my  comments  oti 
Surry  with  respect  to  performance  variability  apply  equally  well  to 
Hale  and  Hale. 

A  change  in  the  operating  system  follows  action,  and  brings  the 
operator  back  to  the  information  stage  of  the  model.    Hale  and  Hale 
include  a  monitoring  function  in  the  loop  back  to  the  situation;  the 
operator  will  periodically  observe  the. operating  system  to  see  that  a 
normal  state  of  affairs  still  exists.     The  frequency  of  monitoring,  it 
is  proposed,  will  be  lower  for  well  practiced  tasks  (i.e.,  routine 
tasks),  and  higher  for  unpracticed  tasks.     Although  Hale  and  Hale  do 
not  mention  this,  the  implication  is  that  expected  information  becomes 
the  only  source  of  perceived  information  in  between  monitoring  occasions. 
Accidents  are  likely  to  occur  between  monitorings,  then,  because  the 
operator  at  this  time  is  performing  the  routine  actions  regardless  of 
the  true  state  of  affairs.     System  aberrations  can  only  be  responded  to 
if  they  occur  vjhen  the  operator  is  monitoring  the  system.    The  frequency 
with  which  the  system  is  monitored,  therefore,  becomes  an  important 
factor  in  the  causation  of  accidents. 

Despite  the  differences  in  the  manner  in  which  Surry  and  Hale  and 
Hale  schematize  their  respective  models,  their  views  on  the  causes  of 
accidents  and  the  process  by  which  accidents  occur  are  highly  compatible. 
The  Hale  and  Hale  model  is  distinguished  from  the  Surry  model,  however. 
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in  two  major  respects:   (1)  in  their  inclusion  of  expectancy  as  an 
equal  contributor  to  perceived  information,  and  (2)  in  their  proposal 
that  observation  of  the  operating  system  (monitoring)  may  be  periodic 
rather  than  continuous.     Several  questions  are  raised  by  these  new 
proposals;  for  example,  what  determines  the  relative  power  of  expected 
versus  presented  information  in  generating  perceived  information,  and 
how  could  the  appropriate  rate  of  monitoring  be  determined  for  a 
particular  operating  system? 

4.  Adaptations  of  the  Hale  and  Hale  model 

Smillie  and  Ayoub  (1976)  expanded  the  Hale  and  Hale  model  to 
include  specification  of  the  input  and  output  possibilities  at  each 
stage.     Their  most  notable  elaboration  of  Hale  and  Hale  consists  of  a 
description  of  the  possible  combinations  of  presented,  expected,  and 
perceived  information.     When  presented  information  is  equivalent  to 
both  the  expected  and  perceived  information,  the  system  is  operating 
normally,  and  normal  operating  activity  follows.     But  three  other 
possibilities  result  in  a  perturbation  of  the  system,  requiring  some 
adaptive  response  that  is  probably  non-routine  and  less  well  learned: 
(1)  presented  information  may  not  be  equivalent  to  the  expected 
information,  and  is  perceived  to  differ,   (2)  presented  information  may 
be  equivalent  to  expected  information,  but  this  equivalence  is  not 
perceived,  and  (3)  presented  information  may  not  be  equivalent  to  the 
expected  information,  and  this  discrepancy  is  not  perceived.     In  the 
first  case  the  operator  knows  that  a  system  aberration  exists,  and  takes 
adaptive  actions.     In  the  second  case  the  operator  believes  that  an 
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aberration  exists  when  in  fact  the  system  is  operating  normally,  and 
takes  "adaptive"  action  that  is  inappropriate  to  the  situation.  And 
in  the  third  case  the  operator  fails  to  notice  that  the  system  is  not 
operating  normally,  and  so  fails  to  take  appropriate  evasive  action. 
(Please  note  that  the  Smillie  and  Ayoub  elaboration  of  these  three 
possibilities,  as  described  in  their  paper,  contains  much  ambiguity. 
While  the  above  interpretation  of  what  they  contribute  is  consistent 
with  Hale  and  Hale,  I  may  have  mis-represented  their  intended  meaning.) 

Smillie  and  Ayoub  make  use  of  their  elaborated  schematic  of  the 
Hale  and  Hale  model  by  developing  a  computer  simulation  of  the  process 
based  upon  it.     While  their  purpose  was  commendable,  their  implementation 
of  the  simulation  did  not  do  justice  to  the  complexities  of  the  model: 
The  variables  included  in  the  simulation  represented  the  important 
psychological  processes  only  at  the  grossest  level,  if  at  all  (for 
example,  experience  could  have  two  values,  present  and  absent),  and 
most  of  the  variables  included  were  secondary  to  the  model  (for  example, 
time  of  day,  temperature,  etc.).     Smillie  and  Ayoub  were  correct  to 
attempt  a  simulation  based  upon  a  model  such  as  Hale  and  Hale;  the 
systems  approach  is  ideally  suited  to  computer  simulation  applications 
because  it  specifies  both  the  time-course  and  the  details  of  a  man- 
machine  interaction. 

Corlett  and  Gilbank  (1978)  adapted  Hale  and  Hale  for  a  different 
purpose,  namely,  as  a  tool  for  the  investigation  and  analysis  of 
accidents.     Corlett  and  Gilbank  present  a  partial  list  of  questions  to 
be  asked  and  answered  during  the  course  of  an  investigation,  a  list 
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that  focusses  primarily  on  the  sequence  of  events  in  Hale  and  Hale. 
They  ask  about  the  completeness  and  correctness  of  the  information 
presented,  and  about  the  physical  objects  that  may  prevent  perception 
of  these.     They  also  attempted  to  obtain  information  relevant  to  the 
operator's  expectancies  by  asking  whether  and  how  often  similar  events 
had  occurred,  whether  the  operator  was  aware  of  these  previous  incidents, 
and  so  on.     While  these  questions  are  far  from  adequate  for  the  task, 
when  accident  investigations  begin  only  after  the  fact,  such  questions 
may  be  the  only  source  of  information  about  the  operator's  expectations, 
given  that  baseline  data  for  the  characteristics  of  the  operating  system 
are  unavailable.     Corlett  and  Gilbank's  attempt  to  adapt  a  system  theory 
for  practical  application  to  investigation  was  an  appropriate  and  noble 
one,  but  it  underscores  the  necessity  for  a  detailed  understanding  of 
the  normally  functioning  operating  system  (a  need  that  is  clear  from 
the  models  of  both  Surry  and  Hale  and  Hale). 

5.  J.  Saari  (1977):     An  example  of  theory-directed  research 

Saari  (1977)  presented  a  simple  information  processing  model  of 
accident  causation  (one  that  is  simple,  yet  compatible  with  the  ideas 
contained  in  Surry  and  Hale  and  Hale)  that  focusses  primarily  upon  the 
complexity  of  information  processing  required  during  the  task  as  an 
important  mediating  factor.     Saari  noted  that  the  information  handled 
by  the  operator  during  a  task  can  be  divided  into  two  parts,   (1)  that 
relevant  to  the  productive  task,  or  the  primary  task,  and  (2)  that 
needed  for  keeping  potential  dangers  under  control,  or  the  secondary 
task.     Saari  proposed  that  an  increased  difficulty  in  either  the 
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primary  or  secondary  task  could  result  in  more  information  than  the 
operator  can  handle  (that  is,  the  information  will  exceed  the  person's 
capacity).     Due  to  the  priority  of  these  two  sources  of  information,  it 
is  secondary  task  information  processing  that  will  be  reduced  when  the 
attentional  capacity  is  exceeded,  and  accidents  will  become  more  likely. 

Saari  proposed  that  information  is  likely  to  exceed  capacity  when 
the  primary  task  is  irregular  (that  is,  non-routine,  such  that  practiced 
skills  become  largely  irrelevant),  and  when  the  primary  task  is  complex, 
requiring  large  amounts  of  information.     On  the  basis  of  these 
theoretical  considerations,  Saari  predicted  a  greater  frequency  of 
accidents  for  jobs  that  (1)  require  continuous  planning  by  the  operator, 
(2)  require  continuous  movement  from  one  location  to  the  next,  and  (3) 
are  performed  in  a  wide  variety  of  settings.     Saari  reports  results 
consistent  with  these  predictions;  accidents  were  more  frequent  for  the 
group  whose  duties  were  characterized  by  these  three  features  (for 
example,  maintenance  workers). 

Neither  the  model  nor  the  research  presented  by  Saari  are  very 
sophisticated.  Nevertheless,  it  illustrates  an  important  benefit  of  the 
systems  approach  to  the  causes  of  accidents;  namely,  that  the  systems 
approach  can  facilitate  the  generation  of  relevant  testable  hypotheses 
to  a  greater  extent  than  did  the  previous,  less  complex,  models. 


-  37  - 

D.  Summary  and  Conclusions 

Theories  of  accident  causation  have  developed  considerably  during 
the  past  sixty  years.     Early  formulations  were  simple  single-factor 
theories  that  satisfied  the  hopes  of  those  who  would  reduce  accident 
rates,  but  that  failed  to  increase  our  understanding  of  the  accident 
process.     Two-factor  theories,  which  considered  two  possible  causes 
instead  of  one  (eg. ,  an  unsafe  act,  or  a  mechanical  hazard)  directed 
attention  more  evenly  between  the  operator  and  the  immediate  work 
environment,  but  failed  to  recognize  the  complexities  of  the  inter- 
action between  the  two.     The  epidemiological  approach  further  sub- 
divided the  environment  into  accident  agent  and  other  environmemt 
factors,  but  again  did  not  fully  appreciate  the  complexities  of  the 
accident  process.     These  latter  theories  proposed  multiple  possible 
causes,  but  never  incorporated  the  idea  that  these  causes  may  contribute 
interactively  rather  than  additively. 

These  theories  and  models  failed  in  another  respect  also.  The 
variables  suggested  to  be  important  for  determining  cause  were  largely 
secondary  level  variables;  variables  that  were  correlated,  or  that 
might  be  correlated  with  accident  occurrence,  but  that  could  not  be  the 
direct  cause  of  the  accident.     These  theories  and  models  did  not  begin 
with  an  analysis  of  the  accident  event  itself  and  describe  how  it  was 
that  an  error  of  some  kind  might  be  made,  and  the  result  of  this  over- 
sight was  that  primary  factors  were  largely  overlooked  or  were  greatly 
simplified.     The  descriptive  information  available  from  accident 
reports  facilitated  this  treatment  of  and  understanding  of  accidents 
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in  terms  of  secondary  factors  because  these  reports  contained  for  the 
most  part  general  information  on  the  state  of  the  operator  and  the 
machine,  and  rarely  could  provide  the  details  of  the  accident  process 
(  previous  theories  did  not  direct  attention  to  the  process.) 

The  systems  theory  approach  to  accidents  emerged  from  a  consideration 
of  the  processes  involved  in  man-machine  interactions.     Systems  theory 
begins  with  a  detailed  analysis  of  machine  and  human  behavior  as  an 
interactive  system,  and  from  this  perspective  it  became  important  to 
know  how  the  machine  behaves  (its  regularities  and  irregularities) , 
how  the  operator  behaves  (sensory,  cognitive,  and  motor  response 
capabilities),  and  whether  the  machine  is  compatible  with  these  human 
limits.     In  general,  systems  theory  approaches  defined  work  place 
accidents  and  errors  an  an  incompatibility  or  a  mis-match  between  the 
human  behavior  and  the  machine  behavior.     From  this  point  of  view,  the 
primary  human  factors  could  be  identified.     These  included  perception 
and  detection  of  state-change  information,  recognition  of  this  infor- 
mation, knowledge  of  its  meaning,  knowledge  of  the  appropriate  response, 
decision  making  with  respect  to  risk  and  probability,  and  response 
speed  and  accuracy.     In  contrast,  the  factors  identified  in  previous 
approaches  (eg.,  epidemiology)  are  secondary,  in  that  they  may  be 
related  (causally  or  otherwise)  to  these  primary  processes.     For  example, 
age  is  very  likely  negatively  related  to  response  speed  and  positively 
related  to  knowledge,  noise  may  be  related  to  perception,  and  so  on. 
Within  the  systems  theory  approach,  epidemiological  methods  may  have  a 
value  in  identifying  these  secondary  factors  once  the  primary  cause 
becomes  known. 
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The  systems  approach  to  industrial  accidents  is  becoming  more  and 
more  accepted  within  the  discipline  in  recent  years,  particularly  in 
Europe  (in  addition  to  the  references  in  Section  C,  refer  to  Leplat 
(1983)  and  Singleton  (1983)).     In  North  America  the  acceptance  of  a 
systems  approach  appears  at  present  to  be  piece-meal  borrowing  rather 
than  total  adoption.     For  example,  Conway  and  Sanders  (1980)  discuss 
the  concept  of  human  error,  and  Arndt  (1980)  discusses  in  general  terms 
the  value  of  a  focus  on  the  man-machine  interaction,  but  these  efforts 
do  not  include  the  detailed  analjisis  that  is  possible  from  a  systems 
theory  perspective.     This  incompleteness  is  probably  due  to  the  greater 
concern  in  North  America  with  accident  investigation  and  prevention 
(that  is,  applied  concerns)  in  response  to  government  regulations  and 
control,  and  a  lesser  concern  with  theory  and  basic  research  into  the 
accident  process.     Nevertheless,  these  writers  have  made  progressive 
suggestions  concerning  accident  research  that  are  clearly  guided  by 
systems  theory.     Conway  and  Sanders,  for  example,  suggest  that  "it  is 
more  productive  to  seek  the  causes  of  human  error  than  to  attribute  the 
cause  to  human  error"  (p.   91),  and  Arndt  (1980)  strongly  advocates 
research  that  will  provide  the  "basic  data  on  capabilities,  frequency 
of  errors,  and  normal  variations  .    .   ."   (p.   Ill),  as  well  as  other 
research  on  topics  basic  to  the  systems  approach.     There  is  every  reason 
to  predict  that  systems  theory  will  be  the  major  guide  for  the  study 
of  accidentsrand  the  prevention  of  accidents  for  the  future. 

As  a  general  conclusion,  then,  the  best  current  approach  for 
understanding  industrial  accidents  is  the  systems  theory  approach,  in 
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its  various  forms.     Choosing  from  the  Surry  model,  the  Hale  and  Hale 
model,  or  some  variation  or  combination  of  systems  models  is  at  this 
point,  I  think,  largely  a  matter  of  personal  preference;  the  amount 
of  research  and  applied  experience  with  these  models  is  too  low  to 
support  an  informed  choice.     Each  has  its  merits  and  its  omissions, 
and  future  use  and  development  of  systems  models  will  likely  indicate 
the  particular  approach  that  best  serves  the  investigation,  research, 
and  prevention  requirements  of  the  industrial  accident  community.  In 
the  remainder  of  this  review  I  will  briefly  suggest  some  of  the 
implications  of  the  systems  theory  approach  for  accident  investigation, 
accident  prevention,  and  accident  research. 
1.   Implications  for  Investigation. 

For  the  cause  of  an  accident  to  be  identified,  systems  theory 
requires  that  the  operating  system,  both  its  regularities  and  its 
aberrations,  be  known.     In  particular,  one  must  know  the  infrequent 
operating  characteristics  of  the  system,  whether  the  operating  system 
consists  of  a  highly  automated  machine  or  a  warehouse.     The  relevant 
question  is  how  often  does  a  particular  danger  cue  occur  within  the 
system,  and  how  often  does  it  precede  an  accident.    An  investigator 
would  want  to  know,  for  example,  how  often  a  machine  squeaks,  and  how 
often  this  irregularity  in  the  system  is  associated  with  an  accident, 
a  near-accident  (avoidance  by  the  operator),  or  a  non-event.     In  the 
warehouse,  for  example,  one  would  want  to  know  how  often  boxes  are  used 
in  place  of  ladders,  how  often  the  box  wobbles  when  stood  upon  (the 
danger  cue?),  and  how  often  injury  or  damage  results  from  such  use. 
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This  type  of  baseline  frequency  information  could  be  obtained 
through  systematic  observation  of  the  operating  system  under  normal 
conditions,  or  perhaps  by  having  workers  report  on  all  instances  of 
perceived  system  aberration  ("close  calls").     The  systematic  observation 
of  an  operating  system  need  not  be  costly  and  time  consuming.     Even  if 
implemented  on  a  modest  scale,  for  example,  observations  on  one  day 
per  week,  or  the  observation  of  a  few  selected  man-machine  systems, 
these  new  investigation  practices  would  contribute  to  the  understanding 
of  accidents  from  a  systems  theory  perspective. 

The  need  for  appropriate  base  rate  information  exists  regardless 
of  the  nature  of  the  theory  that  guides  the  investigation.     Even  when 
the  investigator  only  obtains  data  about  secondary  factors,  baseline 
data  of  the  type  described  above  is  needed  in  order  to  identify  the 
existence  and  direction  of  the  relationship  between  accident  occurence 
and  the  secondary  factor. 

Consider  the  hypothetical  accident  data  shown  in  Table  J^,  which 
show  the  presence  or  absense  of  variable  X  for  100  accidents  of  some 
type.     Example  1  indicates  that  X  (let's  say  that  X  is  noise  level  in 
excess  of  90dB)  is  present  in  65%  of  these  cases.     While  one  might  be 
tempted  to  conclude  that  noise  contributes  to  the  accidents,  these 
accident  data,  by  themselves,  cannot  support  this  conclusion.  Baseline 
data  are  needed  for  this  task,  and  three  possibilities  are  provided 
for  this  example.     For  baseline  "A"  one  can  conclude  that  accident 
rate  is  related  to  high  noise  levels,  but  for  baseline  "B"  one  must 
conclude  that  no  relationship  exists.     However,  if  baseline  "C"  is 
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Table  1 


Example  1 


Accident  Sample 


Value  of  Variable  X 
present  absent 
65%  35% 


Baseline  Sample      A.  35% 

B.  65% 

C.  90% 


65% 
35% 
10% 


Relationship 
Positive 

None 
Negative 


Example  2, 


Accident  Sample 


present 
50% 


absent 
50% 


Baseline  Sample      A.  20% 

B.  50% 

C.  80% 


80% 
50% 
20% 


Positive 

None 
Negative 


Table  1 .    Examples  of  hypothetical  accident  data  to  illustrate  how  the 

conclusions  regarding  the  contribution  of  some  variable  to  the 
accident  are  affected  by  the  nature  of  the  baseline  data. 
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obtained,  one  must  conclude  a  negative  relationship  between  noise  and 
accident  rate;  that  is,  the  relationship  indicates  that  low  noise  levels 
may  contribute  to  accidents.     The  precise  conclusion  that  one  can  reach 
depends  upon  the  nature  of  the  baseline  data;  if  these  data  consist  of 
"close  calls",  the  conclusion  for  "C"  might  be  that  while  the  noisy 
environment  appears  to  be  more  dangerous,  avoidance  of  accidents  is 
more  likely.     Example  2  in  Table      illustrates  the  same  three  types 
of  conclusion  for  the  case  where  the  accident  data  by  themselves  seem 
to  indicate  no  relationship. 

2.  Implications  for  Prevention 

Accident  prevention  efforts  can  be  directed  at  either  the  machinery 
or  the  operators  of  the  machinery.     With  respect  to  the  machine,  systems 
theory  advocates  increasing  the  reliability  and  decreasing  the  fluct- 
uations in  machine  performance.     Proper  maintainence  and  an  appropriate 
equipment  replacement  programme  can  accomplish  this.     But  systems 
theory  suggests  that  something  else  is  very  important  also,  namely,  that 
an  operator  must  be  able  to  detect  those  aberrations  that  cannot  be 
eliminated  by  maintainence  or  replacement.     The  problem  becomes  one  of 
designing  a  machine  that  gives  a  clear  warning  of  impending  danger, 
either  through  direct  sight  and  sound,  or  through  the  use  of  equipment 
that  can  detect  the  danger  cue  for  the  operator.     A  safe  machine,  then, 
is  one  that  gives  sufficient  warning,  but  the  warning  must  also  mean 
that  real  danger  is  very  likely.     A  danger  cue  that  predicts  danger 
80%  of  the  time  is  far  more  efficient  than  one  that  predicts  only  20%. 

With  respect  to  the  human  operator,  systems  theory  suggests  many 
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ways  to  affect  the  operator's  safe  and  efficient  task  performance. 
One  focus  of  systems  theory  that  may  be  very  relevant  for  accident 
prevention  is  its  concern  with  a  variety  of  cognitive  factors  — 
recognition,  judgment,  knowledge,  etc.     The  basic  question  is,  does 
the  operator  know  all  that  needs  to  be  known  about  the  operating  system 
in  order  to  recognize  danger  cues,  recall  the  appropriate  response, 
and  make  an  informed  choice  with  respect  to  the  risk  involved.  Most 
safety  training  programmes  will  include  instruction  on  how  to  do  the 
task  under  normal  operating  conditions,  but  might  underemphasize 
information  about  system  aberrations.    Workers  might  benefit  a  great 
deal  by  being  told  what  danger  cues  he/she  might  encounter  on  the  job. 
Essentially,  this  would  involve  discrimination  training,  having  the 
operator  discriminate  between  normal  and  abnormal  operation  states, 
and  between  safe  and  dangerous  states. 

Accidents  could  also  be  prevented  if  the  operator  knew  how  often 
these  danger  cues  were  likely  to  occur,  and  the  extent  to  which  the 
cue  predicted  ensuing  danger;  this  amounts  to  explicit  instruction 
regarding  the  information  value  of  rare  events,  in  order  to  counteract 
the  tendency  to  ignore  or  fail  to  recognize  the  significance  of  such 
events.     Special  training  should  also  be  provided  on  the  avoidance 
skills  required  in  potentially  dangerous  situations.     I  suspect  that 
job  training  time  spent  on  normal  versus  abnormal  operation  states  is 
roughly  equivalent  to  the  actual  ratio  of  the  occurence  of  these  states. 
Systems  theory,  however,  would  advocate  a  greater  proportion  of  the 
training  time  be  allotted  to  the  less  frequent  occurences,  since  normal 
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operating  procedures  can  be  learned  on  the  job  in  relative  safety, 
while  it  is  clearly  dangerous  to  try  to  learn  responses  to  aberrations 
on  the  job.     Systems  theory  highlights  the  importance  of  knowing  what 
to  do  when  things  go  wrong,  and  the  potential  difficulties  that  exist 
in  gaining  such  knowledge.     Safety  training,  then,  should  strive  to 
create  in  the  worker  these  alternate  performance  skills;  in  terms  of 
Hale  and  Hale's  concept  of  expectancy,  the  operator  should  have  two 
equal  expectancies  for  any  task,  one  for  normal  conditions,  and  one 
(or  one  set)  for  aberrant  conditions. 

This  recommendation,  then,  is  for  specific  instruction  regarding 
danger  cues  and  system  abnormalities.     This  could  be  accomplished  in 
many  cases  through  the  use  of  system  simulators  (cf . ,  flight  simulators). 
A  simulation  could  easily  vary  the  frequency  and  diagnosticity  of 
danger  cues  and  system  fluctuations  to  levels  above  and  below  their 
natural  values,  and  thereby  provide  the  experience  of  accidents  and 
dangerous  incidents  in  complete  safety. 

3.  Implications  for  Basic  Research 

The  implications  of  systems  theory  for  accident  investigation  and 
prevention  require  the  support  of  basic  research  into  the  accident 
process.     Basic  research  is  needed  to  identify  and  direct  the  changes 
to  be  made  and  the  methods  to  be  used  in  these  applied  areas.  Methods 
for  observing  and  recording  the  operating  system,  and  for  determining 
the  danger  cues,  must  be  developed.     Also,  basic  research  should  direct 
attention  toward  the  human  limits  with  respect  to  perception,  recognition, 
recall,  risk  judgments,  and  performance    in  both  experimentally 
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controlled  settings  and  normal  operating  conditions.     This  research 
might  ask,  for  example,  whether  a  particular  danger  cue  can  be 
recognized  in  a  variety  of  settings,  or  what  factors  contribute  to 
the  memorability  and  recognition  of  rare  but  potentially  dangerous 
circumstances,  and  what  sort  of  training  interventions  could  increase 
the  memorability  of  such  conditions. 

Basic  research  could  also  direct  attention  toward  the  distinction 
between  primary  and  secondary  human  factors;  in  particular,  the  research 
might  determine  the  relationship  between  secondary  human  and  environment 
factors  and  the  individual's  perceptual,  cognitive,  and  performance 
abilities.    More  complex  research  questions  also  suggest  themselves. 
For  example,  to  what  extent  can  operators  compensate  for  the  presence 
of  one  debilitating  influence  by  increasing  the  efficiency  of  some 
other  primary  process?  can  this  "compensation"  skill  be  taught?  etc. 

There  are  very  many  research  questions  that  can  be  asked,  and 
many  of  these  are  necessary  if  systems  theory  is  to  be  a  useful  tool 
for  accident  investigation  and  safety  training.     It  is  for  this  reason, 
above  all  others,  that  the  systems  theory  approach  to  accidents  is  the 
best  currently  available;  systems  theory  provides  research  direction. 
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Research  Branch  Note 


In  the  epidemiology  of  diseases,  the  general  cause  of  the 
disease  is  known  in  the  sense  that  the  investigator  assumes  the 
cause  to  be  an  infectious  agent  (i.e.,  bacterium  or  virus)  or, 
in  the  case  of  occupational  illness,  a  substance  to  which  the 
population  of  interest  may  be  exposed  in  the  workplace  (e.g., 
vinyl  chloride  monomer  or  asbestos).  However,  the  precise 
nature  of  this  causative  agent  does  not  have  to  be  identified 
prior  to  conducting  an  epidemiological  study. 
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